In the event of a data breach, when should the institution notify the U.S. Department of Education?

• A. The school is required to report the data breach on the same day that the data breach is detected or suspected
• B. As soon as the institution's data security manager has completed their assessment of the situation and corrected any data security issues
• C. At the conclusion of the incident; that is, after all issues have been addressed and any impacted students and/or staff have been notified and corrective action has been taken
• D. The school may notify ED at their discretion

Answer: (C)

The main idea here is when to report a data breach to the U.S. Department of Education. The best approach is to notify after the incident has been resolved: once the issues have been addressed, affected students or staff have been notified, and corrective actions are in place. Providing ED with a complete, post-incident picture helps the department assess the breach, the scope of impact, and the steps taken to prevent recurrence. Reporting too early—on the day of detection or after only an initial assessment—can yield incomplete or evolving information, which isn’t as useful for oversight and remediation. Leaving the timing to your discretion could also lead to delays or inconsistent practices.